Privacy Policy

Information you or your organization provide directly:

• Account data: name, email address, authentication details, and account preferences.
• Organization data: company legal name, d/b/a, entity type, state of formation, and notice address.
• Property and lease data: property addresses, descriptions, photos, lease terms, rent amounts, and related records.
• Applicant and tenant data: names, contact details, date of birth, government-issued ID or Social Security number, rental history, employment and income information, references, application documents, screening authorizations, and signatures, when a Customer uses those features. We encrypt Social Security numbers before storage and retain only the last four digits in a separately accessible form for identification.
• Screening data: when a Customer orders a tenant screening report through the Service (Section 5), the applicant's identifying information is entered directly into the consumer reporting agency's own hosted intake flow. We receive and store the agency's eligibility result and a report reference; we do not receive or store the full consumer report.
• Signing and proposal data: if you visit a DoorStopper proposal or contract-signing page (typically on a gated client subdomain of doorstopper.io), we collect the company information entered on that page (legal name, d/b/a, entity type, state, notice address, and email), the signer's name, title, and email, the electronic signature, a cryptographic hash of the visitor's IP address, browser user-agent string, and the timestamps of each step. We retain this information even if the visitor does not complete signing, so we can follow up about the proposed agreement.
• Billing data: payment and subscription information processed by Stripe. We do not store full card numbers.
• Communications: emails, text messages, and other messages sent through or to the Service, including support requests.

Information collected automatically:

• Usage data: pages viewed, features used, time spent, and interactions with the Service.
• Device data: IP address, browser type, operating system, and device identifiers.
• Cookies: session tokens and preference cookies. See Section 10.

We use the information we collect to:

• Create and manage accounts and operate the Service, including AI-assisted drafting and workflow automation (Section 6);
• Coordinate the DoorStopper Protect program and tenant screening described in Sections 4 and 5;
• Process payments and manage subscriptions;
• Send transactional messages (confirmations, receipts, password resets, case and deadline notices);
• Send product updates and announcements (you can unsubscribe from marketing messages);
• Respond to support requests and communicate with you;
• Follow up on an incomplete proposal or signing session;
• Detect and prevent fraud, abuse, and security incidents;
• Comply with applicable legal obligations; and
• Analyze usage patterns to improve the platform.

We do not sell personal information, as that term is used under applicable data-protection or privacy law.

We share information only as described below:

• Service providers who help us operate the Service. As of this Policy's effective date, this includes Vercel (application hosting), Supabase (database, authentication, and storage), Stripe (payment processing), Resend and Postmark (transactional email, depending on configuration), Twilio (text messaging, when configured), Dropbox Sign (electronic signatures, when configured), Anthropic and OpenAI (AI-assisted drafting, described in Section 6), and Google Workspace (our own business email). See our Subprocessors page for the current roster.
• The DoorStopper Protect Provider. Described in Section 4.
• The consumer reporting agency used for tenant screening. Described in Section 5.
• Other transaction participants, such as property owners, property managers, applicants, and tenants, when needed to provide a feature a Customer has requested (for example, sharing a screening result with the property manager who ordered it).
• Legal requirements: when required by law, court order, or government authority.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to applicable notice requirements.
• With your consent: for any other purpose you specifically agree to.

DoorStopper Protect is our software workflow for coordinating a third-party rent-protection program. DoorStopper is not an insurer, guarantor, surety, insurance agent, or insurance broker. A licensed third party (the "Protect Provider") decides eligibility, issues the terms of its program, and decides and pays any benefits. We do not decide eligibility, coverage, or claims.

When a Customer enrolls a lease in Protect, we share the lease, tenant, and rent-payment information the Protect Provider's program requires — for example property and lease identifiers, payment and default status, and the applicant's screening eligibility result — with that Protect Provider, so it can evaluate eligibility and process benefit requests. We disclose to a Protect Provider only the fields its program requires; we do not send it full consumer reports, bank credentials, or full payment-card numbers. If you have questions about a specific Protect Provider's own privacy practices, its own terms and privacy notice govern that provider's use of your information — we are not a party to them.

When a Customer orders a tenant screening report through the Service, DoorStopper coordinates the order; the report itself is prepared by a third-party consumer reporting agency. The fee is $49 per adult applicant or guarantor.

DoorStopper is not a consumer reporting agency and does not make screening or leasing decisions. Under the Fair Credit Reporting Act, the property manager who orders a report is responsible for having a permissible purpose, obtaining the applicant's authorization, and — if it takes an adverse action based on the report — sending the applicant the required adverse-action notice. This Policy does not describe the consumer reporting agency's own privacy practices; its own disclosures govern its handling of the report.

Some communications, reports, and workflow steps in the Service are drafted or automated using AI models, under rules and approval controls the Customer sets up and can change or pause at any time. AI drafting tools receive only the data needed to prepare the specific draft — which may include resident and owner names, property addresses, payment status, and the text of communications — and never receive bank credentials, full payment-card numbers, or Social Security numbers. An AI tool drafts text; it does not decide whether a communication is sent, to whom, or make the underlying regulated or business decision (such as a screening outcome, adverse-action notice, legally required tenant notice, or claims decision). Under our current agreements with our AI providers, we do not permit those providers to use Customer data to train or improve their general-purpose models, and we use the most restricted data-retention settings those providers offer.

We retain personal information for as long as reasonably necessary to provide the Service, maintain transaction and acceptance records, meet legal, tax, accounting, fraud-prevention, and security obligations, and resolve disputes. Retention varies by record type:

• Billing records are retained for at least 7 years for tax and accounting purposes.
• Evidence files assembled for a Protect case are retained only while the case is open, plus 12 months, unless a Customer instructs otherwise in writing.
• Signing and proposal records (Section 1) are retained as part of our contracting and audit history.
• After an account is closed, or a Customer's agreement with us ends, we delete the associated production personal data within 30 days, except where we are permitted or required to retain it longer (for example, billing records, or an open Protect case's evidence file).

To request deletion, submit a request through our privacy request form. We will evaluate and fulfill verified requests as required by applicable law; some records may be retained where a legal exception or obligation applies.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing of your data for certain purposes.
• Opt-out of marketing: unsubscribe from marketing emails at any time via the unsubscribe link.

California residents have additional rights under the CCPA, including the right to know what personal information is collected and the right to non-discrimination for exercising privacy rights. We do not sell personal information, so there is no sale to opt out of.

If you live in a state with its own comprehensive privacy law (for example Virginia, Colorado, Connecticut, or Utah), you may have similar rights under that law. We will honor a verified request consistent with the law that applies to you.

To exercise any of these rights, submit a request through our privacy request form. We will respond within 30 days. Because much of the personal data in the Service is supplied by a Customer (a property manager) about its tenants, applicants, and owners, we may need to direct certain requests to that Customer, who controls that data.

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit (TLS) and encryption at rest provided by our hosting infrastructure, access controls limiting internal access to personal data to personnel who need it to do their jobs, and multi-factor authentication on our administrative accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We are not currently certified under any third-party security framework (such as SOC 2 or ISO 27001).

We use cookies and similar technologies to operate and improve the Service:

• Essential cookies: required for authentication and session management. Cannot be disabled.
• Preference cookies: store your settings and preferences.
• Analytics cookies: help us understand how the Service is used. You can opt out.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from using authenticated features of the Service.

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it promptly.

We operate in the United States, and our service providers may process data in the United States and other countries. By using the Service, you consent to such transfers. We require appropriate safeguards from our service providers consistent with applicable law.

Where DoorStopper and a Customer have executed a separate written agreement — including a Master Services Agreement, Order Form, Data Processing and Security Addendum, or DoorStopper Protect Program Agreement — the data-handling, retention, subprocessor, and security terms of that signed agreement control over this Policy for the services it covers, to the extent of any conflict.

We may update this Privacy Policy from time to time. We will notify affected users of material changes by email or prominent notice within the Service before the changes take effect. The "Effective" date at the top of this Policy reflects the most recent revision.

For privacy-related questions, data access requests, or to exercise your rights, use our privacy request form.

General inquiries: kelvin@doorstopper.io

Mail: DoorStopper Inc., 703 N Alma School Rd, Chandler, Arizona 85224